<html>
<head><meta charset="utf-8"><title>Comparison of potentially-unrelated pointers undefined? · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison.20of.20potentially-unrelated.20pointers.20undefined.3F.html">Comparison of potentially-unrelated pointers undefined?</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="161312058"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison%20of%20potentially-unrelated%20pointers%20undefined%3F/near/161312058" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison.20of.20potentially-unrelated.20pointers.20undefined.3F.html#161312058">(Mar 21 2019 at 03:04)</a>:</h4>
<p>In intent and in current practice, is it valid to compare pointers to potentially-unrelated objects using <code>&lt;</code> and <code>&lt;=</code>. In particular, is this valid?: <a href="https://play.rust-lang.org/?version=stable&amp;mode=debug&amp;edition=2018&amp;gist=bdc00ec41449ab4eb285f96cc0ba3e39" target="_blank" title="https://play.rust-lang.org/?version=stable&amp;mode=debug&amp;edition=2018&amp;gist=bdc00ec41449ab4eb285f96cc0ba3e39">https://play.rust-lang.org/?version=stable&amp;mode=debug&amp;edition=2018&amp;gist=bdc00ec41449ab4eb285f96cc0ba3e39</a></p>



<a name="161312124"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison%20of%20potentially-unrelated%20pointers%20undefined%3F/near/161312124" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison.20of.20potentially-unrelated.20pointers.20undefined.3F.html#161312124">(Mar 21 2019 at 03:04)</a>:</h4>
<p>Also, where are such things (to be) documented?</p>



<a name="161345588"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison%20of%20potentially-unrelated%20pointers%20undefined%3F/near/161345588" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison.20of.20potentially-unrelated.20pointers.20undefined.3F.html#161345588">(Mar 21 2019 at 13:40)</a>:</h4>
<p>You can run code under miri in the playground to check what's currently supported.</p>



<a name="161345757"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison%20of%20potentially-unrelated%20pointers%20undefined%3F/near/161345757" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison.20of.20potentially-unrelated.20pointers.20undefined.3F.html#161345757">(Mar 21 2019 at 13:42)</a>:</h4>
<p>Once layout and validity are rfc'ed we'll probably start with a model for MIR and move towards stacked borrows afterwards. We'll have to deal with pointer comparisons and provenance along the way.</p>



<a name="161347189"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison%20of%20potentially-unrelated%20pointers%20undefined%3F/near/161347189" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison.20of.20potentially-unrelated.20pointers.20undefined.3F.html#161347189">(Mar 21 2019 at 13:59)</a>:</h4>
<p>Interesting. I'll try it (though t's not clear to me that MIRI's interpretation is equivalent to what LLVM would generate. In fact I think it's unlikely they're equivalent).</p>



<a name="161347225"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison%20of%20potentially-unrelated%20pointers%20undefined%3F/near/161347225" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison.20of.20potentially-unrelated.20pointers.20undefined.3F.html#161347225">(Mar 21 2019 at 13:59)</a>:</h4>
<p>So, is it the case that right now that code is literally undefined behavior because nobody has even tried to define it?</p>



<a name="161358312"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison%20of%20potentially-unrelated%20pointers%20undefined%3F/near/161358312" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison.20of.20potentially-unrelated.20pointers.20undefined.3F.html#161358312">(Mar 21 2019 at 15:48)</a>:</h4>
<p>comparison of pointers is one of those things where Miri is very limited in its support currently</p>



<a name="161358335"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison%20of%20potentially-unrelated%20pointers%20undefined%3F/near/161358335" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison.20of.20potentially-unrelated.20pointers.20undefined.3F.html#161358335">(Mar 21 2019 at 15:49)</a>:</h4>
<p>and also, it is an open question in every formal model that I know of</p>



<a name="161358356"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison%20of%20potentially-unrelated%20pointers%20undefined%3F/near/161358356" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison.20of.20potentially-unrelated.20pointers.20undefined.3F.html#161358356">(Mar 21 2019 at 15:49)</a>:</h4>
<p>the intent is clearly that it is defined (as in, not UB), because it is allowed in safe code</p>



<a name="161358462"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison%20of%20potentially-unrelated%20pointers%20undefined%3F/near/161358462" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison.20of.20potentially-unrelated.20pointers.20undefined.3F.html#161358462">(Mar 21 2019 at 15:50)</a>:</h4>
<p>and in the most elaborate model, it is indeed not UB -- however, under some circumstances pointer comparison (not just <code>&lt;</code> but also <code>==</code>) is nondeterministic, meaning comparing the same two pointers multiple times can yield a different result</p>



<a name="161358499"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison%20of%20potentially-unrelated%20pointers%20undefined%3F/near/161358499" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison.20of.20potentially-unrelated.20pointers.20undefined.3F.html#161358499">(Mar 21 2019 at 15:50)</a>:</h4>
<p>the intent in LLVM is for it to be deterministic, but so far nobody has demonstrated a way to actually model that (and maintain the desired optimizations)</p>



<a name="161358685"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison%20of%20potentially-unrelated%20pointers%20undefined%3F/near/161358685" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison.20of.20potentially-unrelated.20pointers.20undefined.3F.html#161358685">(Mar 21 2019 at 15:52)</a>:</h4>
<p>if you want to be on the safe side model-wise, cast the pointers to <code>usize</code> and compare those. then everyone agrees that behavior is defined and deterministic.</p>



<a name="161378802"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison%20of%20potentially-unrelated%20pointers%20undefined%3F/near/161378802" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison.20of.20potentially-unrelated.20pointers.20undefined.3F.html#161378802">(Mar 21 2019 at 19:30)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> In an ABI where the upper bits of pointers are used to store authentication information, <code>a &lt; b</code> doesn't imply that <code>(a as usize) &lt; (b as usize)</code> unless the <code>as usize</code> conversion masks those bits in the same way that a <code>a &lt; b</code> pointer comparison would; but if that kind of masking were to be done then <code>p as usize</code> wouldn't be equivalent to <code>(uintptr_t)p</code> in C (IIUC). That's why I'm trying to avoid converting to <code>usize</code>.</p>



<a name="161378824"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison%20of%20potentially-unrelated%20pointers%20undefined%3F/near/161378824" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison.20of.20potentially-unrelated.20pointers.20undefined.3F.html#161378824">(Mar 21 2019 at 19:30)</a>:</h4>
<p>Based on the current discussion, for the use case that motivated me to start this thread, I'm going to switch away from the scheme that I was planning to use that required pointer ordering comparisons in factor of explicitly tagging which buffers are overlapping. Thanks for the responses!</p>



<a name="161391614"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison%20of%20potentially-unrelated%20pointers%20undefined%3F/near/161391614" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison.20of.20potentially-unrelated.20pointers.20undefined.3F.html#161391614">(Mar 21 2019 at 20:11)</a>:</h4>
<p>I have to admit I gave no thought to ABIs that encode things in the upper bits of pointers. There are already enough open questions without such extra constraints.^^</p>



<a name="161396334"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison%20of%20potentially-unrelated%20pointers%20undefined%3F/near/161396334" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison.20of.20potentially-unrelated.20pointers.20undefined.3F.html#161396334">(Mar 21 2019 at 21:15)</a>:</h4>
<p>Here is a summary of one such platform (ARMv8.3): <a href="https://lwn.net/Articles/718888/" target="_blank" title="https://lwn.net/Articles/718888/">https://lwn.net/Articles/718888/</a></p>



<a name="161743901"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison%20of%20potentially-unrelated%20pointers%20undefined%3F/near/161743901" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Comparison.20of.20potentially-unrelated.20pointers.20undefined.3F.html#161743901">(Mar 26 2019 at 09:21)</a>:</h4>
<p>thanks for the pointer!</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>